How would you use a CDN in front of a dynamic application?

Cache aggressively what is safe and be surgical about the rest. Give static assets fingerprinted filenames and a very long max age, so they are cached forever and busted by a new name. For dynamic responses, use short lifetimes with stale while revalidate, and keep the cache key minimal, since including every cookie or query parameter destroys the hit rate. Terminate TLS at the edge and put your firewall and rate limiting there too.

Static assets are the easy win: fingerprint the filename with a content hash, cache for a year, and never invalidate, because a change produces a new name. Get that right and most of your bytes never reach the origin. Dynamic responses need more care. The cache key is the thing people get wrong: if the CDN keys on every cookie and every query parameter, then a session cookie or a tracking parameter gives every user their own entry and the hit rate collapses. So I strip the key down to what genuinely changes the response and normalize the rest. For content that is the same for everyone but changes occasionally, like a product page, a short lifetime plus stale while revalidate gets nearly all the benefit with tolerable staleness, and I use tags so a publish can purge exactly the affected pages. Truly personalized content either bypasses the cache or gets assembled at the edge from a cached shell. On top of that, TLS terminates at the edge, compression happens there, and the firewall and rate limiting sit there too, which keeps a lot of noise away from the origin entirely.